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BACKGROUND OF THE INVENTION 

Description of the Related Art 

Information can be transmitted faster and more easily than ever since the advent 
of the computerized information networks, such as the Internet. Facsimile machines, 
15 computers, and electronic appliances such as personal digital assistants (PDAs) and 
wireless telephones with Internet access enable the quick transfer of information to 



□ remote locations around the world. 

,J The capability to quickly and easily transfer information does, however, have 

^ certain drawbacks. Information in digital form, while readily transferable, may also be 

1 ' 20 accessed by more entities than ever before, including those who are not intended to be 
recipients. Copyrighted digital content can often be illegally sent from point A to point B 

IZl 

without being detected, files can be corrupted or infected with viruses that can shut down 
iZ recipients' computers, and confidential information can be transmitted or posted on 

-^"^ publicly accessible network sites. For these reasons, electronic content providers, 

25 businesses, and individual users are increasingly concerned with copyright protection, 

vims protection, and security issues. 

Commercial content providers are concerned with the prevalent copying without 
compensation of digital content, such as compact disks (CDs), electronic books, digital 
movies, and digital video disks (DVDs), Individual content users often are at cross 
30 purposes with content providers, desiring unauthorized copying of content, including 
digital music, software programs, movies, digital books, images and the like. Content 
creators, who desire as wide an audience as possible, often are torn between 
dissemination goals and compensation goals. 

The Internet Backbone provides the major interconnections between disparate 
35 networks and includes the following components: 
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5 Network service providers (NSP) which operate the networks that route packets of 

data from point to point. A NSP offers National/International interconnecting Internet 
services to internet service providers (ISPs) through network access points (NAPs). 

Long Distance Carriers (telephone) provide a national network of communication 
channels for the Internet as well as other long distance voice and data communication 
10 needs. In general, the NAP contracts with a Long Distance Carrier for the channels 
needed for their backbone. 

Network Access Points (NAPs) provide for the exchange of packets between 
networks operated by the Network Service Providers. 

Primary National Service Providers collectively operate what is often referred to 
Ji 15 as the Pubhc Internet Backbone. Each Primary National Service Provider operates one or 
iy more Wide Area Networks, typically using either Frame Relay and/or asynchronous 

[11 transfer mode (ATM) architectures on a national basis. Local ISPs typically use these 

Primary National Service Providers as their interface point to the Internet Backbone. 

1=^ Primary National Service Providers and National Internet Service Providers 

2 20 exchange packets at Network Access Points. The routers used by a backbone provider 
^ use Border Gateway Protocol (BGP) to dynamically learn routes. When the owner of an 

M= IP address changes ISP providers, it announces its new provider to the rest of the world 

using BGP, which causes the world's routers to adjust their routing tables to account for 

the change. 

25 Point of Purchase (POP) locations of digital content currently reside within the 

workstation networks of digital content suppliers and Intemet retailers. Network Access 
Points (NAPs), such as network service providers, currently do not have the ability to 
control or charge for the re-transmittal of digital content. 

Outside of digital content workstations or supplier systems. Federal, State and 
30 local governments currently do not have the ability to identify potentially taxable 
transactions, such as the traasmission of digital content for sale between a content 
provider and a user, or retail purchases. Similarly, there currently are no systems to 



-2- 



M-n742 US 
765930 v7 

k 

5 impose, track, and protect taxation of identified digital content on a state, or local level 
for point-to-point transfers between non-authorized suppliers of digital content. 

There currently are numerous methods used to identify and protect digital content 
between suppUers and users, but each method has limitations. 

One method of protecting information uses watermark technology, which marks 
10 rendered works, including text, digital pictures, and digital audio with information that 
identifies the work or the pubUsher. The human eye can read some types of watermarks, 
while other types can be read only electronically. 

Another known security technique uses fingerprint technology. The term 
fingerprint is sometimes used in contrast with watermarks to form a message digest of the 
t 15 document. Fingerprinting is typically accomplished using one of a number of types of 
ii hash functions. A common hash fiinction is the one-way hash function that provides a 

S fixed-length hash vahie, A, after operating on an arbitrary-length pre-image message. 

W The h is unique to the message associated with it. However, the security of the h depends 

W on the nvimber of bits of the hash. A practical size is 128. There are a number of 

20 different types of hashing algorithms, including the Message Digest (MD) 4 algorithm, 
Ca and the MD5 algorithm, which is more complex than the MD4 algorithm. Another type 

of hash function is the n-hash algorithm, which implements a random function hashing 
H and logical exclusive OR ftinctions. 

Another aspect of the security of electronic content pertains to Digital Rights 
25 Management (DRM). DRM entails estabUshing and managing rights and permissions for 
digital content and supports distribution of digital content. DRM can be used for digital 
distribution of educational, professional and trade content as well as entertainment 
content. However, DRM imposes new hardware and software requirements on users to 
facilitate its implementation, and does not easily integrate with existing systems in 
30 the marketplace. 

Another method of protecting information involves the use of cryptographic key 
solutions. One type of cryptographic key solution uses symmetric keys in which an 
encryption key can be calculated from the decryption key and vice versa. A more secure 
key solution uses asymmetric keys in which the key used for encryption is different from 
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5 the key used for decryption. A user desiring to communicate with another retrieves the 
destination certificate from a database and verifies authenticity. Verifying authenticity 
often involves several Certification Authorities (CAs) if there is a hierarchy of CAs 
between the user's CA and the destination CA. After verification, communication may 
take place by using the keys to "unlock" encrypted containers containing the protected 

10 messages. Typically, timestamps are used to confirm that messages are current. 
Alternatively, a three-way protocol involves the user checking a random number that was 
originally generated by the user, sent to the destination, and received back from the 
destination. Likewise, the destination checks a random number received from the user 
that was originally generated at the destination. This type of security is not conducive to 

1 5 mass distribution of digital content. 

U Another alternative for limiting unauthorized access involves monitoring network 

is; traffic at the intemal network level through firewalls, proxy servers, or access lists. These 

^ systems are designed to prevent users from accessing pre-designated sites or pre- 

iri designated file types over the Litemet. This approach applies access rules to prevent files 

20 having designated attributes, such as particular suffix, from being transferred into and/or 
out of the organization. The access rules can be cumbersome and costly to establish and 
[:l maintain for both small and large organizations. 

^0 Another form of security relates to virus protection. Virus protection is a global 

C issue with the advent of the Litemet and impacts large and small organizations and 

25 individual users. Virus scanning is currently performed at end local nodes and 
workstations. Thus, viruses can be stopped only once they have spread and been 
identified within these systems. This approach cannot prevent viruses from spreading 
prior to being distributed to the local nodes or workstations. 

U.S. Patent No. 5,629,980 describes a system which provides for the secure and 
30 accounted-for distribution of digitally encoded works. The owner of a digital work 
attaches rights to the work that define how that work may be used and fiirther distributed. 
It is assumed that digital works reside on a secure depository, and depart only when the 
requestor meets certain rights. Once a digital work leaves the digital domain, e.g. it is 
printed out, played or otherwise rendered, it is no longer secure and can be copied by 
35 unauthorized users. 
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5 U.S. Patent No. 6,233,684 describes a system for controlling the distribution and 

use of rendered digital works though watermarking. It is assumed that there are trusted 
entities on the hitemet that enforce certain rules for watermarks and fingerprints 
whenever content is duplicated. First, a social reminder appears on the material to 
indicate whether duplication is acceptable. Second, auditing features record when copies 
10 are made. Third, copy detection is enforced so that duplicates can be differentiated 
from originals. 

U.S. Patent No. 6,1 12,181 describes systems and methods for matching, selecting, 
narrowcasting, and/or classifying content based on rights management and/or other 
information. A matching and classification system is used to filter masses of data for the 

15 benefit of the user. The system proposes a "matchmaker" to locate content, which would 
!:=£: have value to the user, but ignores content that would be irrelevant. Thus, this tool 

focuses on helping a user identify content he or she may want to purchase. It does not 
^ assist the provider with a means to bill the user. 

i.n U.S. Patent No. 6,233,618 describes a technique to limit access to information 

'''' 20 content available on the Internet. The technique includes filtering data and is 
implemented within a network device such as a proxy server, router, switch, firewall, 

if"; 

bridge or other network gateway. Information about the site to which the request for data 
J^J was made is used to help determine whether or not the material should be filtered. The 

M= access control process analyzes data in each request from the clients and determines if the 

25 request should be forwarded for processing by a server to which it is destined. 

U.S. Patent No. 6,216,173 discloses a system in which the content of a packet 
determines its routing through a network. The path a packet follows through the network 
is determined, at least partially, by the type of data carried within the packet itself. For 
example, a web request could be fulfilled by routing a packet to a nearby router. Some 
30 requests can be processed by software on the local workstation. 

U.S. Patent No. 6,205,148 describes selecting a higher-level protocol for packets 
in a router. Usually, routers enumerate each of the possible protocols for packets, then 
send that number as a field in the packet. This is done, for example, with IP packets. 
Each IP packet determines if the embedded packet uses, for example, the TCP or UDP 
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5 protocols. The disclosure deals primarily with asynchronous transfer mode (ATM), and 
means to identify packets that could be transmitted over ATM. 

The currently known methods, such as the methods described in the preceding 
paragraphs, are designed for denying access to designated data or sites, rather than 
allowing free flow of digital content over the Internet. Currently known methods do not 

10 provide capabiUty for conducting transactions on designated digital content at a price 
estabUshed by authorized selling agents and content owners, or a standard tool for 
blocking designated digital content from unauthorized users. A transaction gateway point 
is needed that provides better data management both going to and coming from the 
Internet backbone than what is provided by currently known systems. Once this gateway 

15 point is established, applications can be installed that solve many data 
management issues. 

SUMMARY 

A system and method in accordance with the present invention provides a 
transaction gateway point with a data enabling point at the NAPs to non-intrusively 
20 manage data packets transmitted on the Internet backbone is provided. 

In one embodiment, a system for controlling transmission of data packets in an 
information network in accordance with the present invention comprises a Regional 
Transaction Processor (RTP) operable to communicate with a Data Enabling 
Device (DED) and at least one workstation. The DED searches data packets for content 

25 match information. The RTP includes instructions to generate information to include in a 
prompt to be presented at the workstation when the content match information is detected 
in at least one of the data packets. The prompt is based on information in the at least one 
data packet. Transmission of the data packets through the infomiation network is 
suspended by the DED until a response to the prompt is received that authorizes 

30 downloading the data packets to the workstation. If transmission of the data packets to 
the workstation is not authorized, the data packets are discarded by the DED. 

In one aspect of this embodiment, the prompt is based on the content match 
information. 
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5 In another aspect of this embodiment, the DED is operable to detect when the one 

or more data packets include content match information at a rate proportional to the rate 
at which the data packets are received. 

In another aspect of this embodiment, the DED prevents further transmission of 
the one or more data packets based on the content match information. 

10 In another aspect of this embodiment, the RTP comprises a network server and a 

database, and is operable to process transactions for requests for content. 

In another aspect of this embodiment, the DED is located at a Network Access 
Point (NAP). 

In another aspect of this embodiment, the system includes a plurality of DEDs 
15 along a network route. Each DED is operable to communicate with at least one of the 
other DEDs. The plurality of DEDs include a first DED that generates the prompt and 
one or more intermediate DEDs operable to forward the prompt to the DED closest to the 
workstation along the network route. The plurality of DEDs are operable to communicate 
with each other to prevent transmitting more than one prompt for the same data packet 
20 through the network route. 

In another aspect of this embodiment, the RTP transmits a Release_Content or 
Cease_Content message to the DED, based on whether the at least one data packet was 
authorized to be downloaded to the workstation. 

In another aspect of this embodiment, the DED includes field programmable gate 
25 arrays (FPGAs). The FPGAs can be reprogrammed over the network to perform a 
content matching function in accordance with the present invention. 

In another aspect of this embodiment, a portion of the DED can be dynamically 
reprogrammed and the DED is operable to continue processing the data packets dtiring 
the partial reprogramming. 
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5 In another aspect of this embodiment, the DED includes a hardware-based data 

packet processor and a software-based data packet processor. 

In another aspect of this embodiment, a CSBS communicates with the RTP to 
monitor operation of the RTP, and to store transaction information. The CSBS is 
operable to transmit information to reprogram the DED to communicate with 
10 another RTP. 

In another aspect of this embodiment, a content matching server (CMS) is 
operable to store content match information, to communicate with the DED, and to 
transmit the content match information to the DED. 

Ihii: In another aspect of this embodiment, the DED is operable to suspend 

J2 15 transmission of the data packets through the information network until a response to the 
prompt is received. 

In another embodiment, a method for controlling transmission of identifiable 
s content over an information network in accordance with the present invention includes: 

providing content match information for the content to a DED. The DED is 
H 20 located in the information network along a transmission path of a plurality of data 
Fi packets. At least one data packet includes the content match information; 

receiving the at least one data packet in the DED; 

detecting the content match information in the at least one data packet in the 
DED, and 

25 issuing a prompt to a workstation based on the content match information when 

the content match information is detected in the at least one data packet. 

In one aspect of this embodiment, the method includes processing a transaction 
based on a user's response to the prompt. 

In another aspect of this embodiment, the method includes transmitting a message 
30 among a plurality of DEDs along the transmission path to prevent transmitting more than 
one prompt for the same data packet. 
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5 In another aspect of this embodiment, the method includes processing a 

transaction based on the content match information, and transmitting a Release_Content 
or Cease Content message to the DED based on whether content was authorized to be 
downloaded to the workstation during the transaction. 

In another aspect of this embodiment, the method includes reprogramming a 
10 portion of the DED to detect different content match information. 

In another aspect of this embodiment, the method includes suspending 
transmission of the at least one data packet through the information network until a 
response to the prompt is received. 

In another embodiment, an apparatus for controlling transmission of data packets 
15 in an information network includes a Regional Transaction Processor (RTP) operable to 
communicate with a DED and at least one workstation. The DED detects content match 
information in at least one of the data packets. The RTP includes instructions to generate 
information to include in a prompt to be presented at the workstation. The prompt is 
based on information in the at least one data packet. 

20 In one aspect of this embodiment, the DED detects the content match information 

at a rate proportional to the rate at which the data packets are received. 

In another aspect of this embodiment, the DED prevents further transmission of 
one or more of the data packets based on the information in the at least one data packet. 

In another aspect of this embodiment, the RTP further comprises instructions to 
25 process a transaction based on the information in the at least one data packet. 

In another aspect of this embodiment, a plurality of DEDs are positioned along a 
network route, and each DED communicates with at least one of the other DEDs. The 
plurality of DEDs include a first DED that generates a message and one or more 
intermediate DEDs operable to forward the message to the DED closest to the 
30 workstation along the network route. The plurality of DEDs to communicate with each 
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5 other to prevent transmitting more than one message for the same data packet through the 
network route. 

In another aspect of this embodiment, the RTP transmits a Release Content or 
Cease_Content message to the DED, based on whether the at least one data packet was 
authorized to be downloaded to the workstation during the transaction. 

10 In another aspect of this embodiment, a portion of the DED can be dynamically 

reprogrammed and the DED can continue performing content matching functions during 
the partial reprogramming. 

In another aspect of this embodiment, the RTP communicates with a Central 
U Storage And Backup System (CSBS). The CSBS monitors operation of the RTP, and 

S 15 stores transaction information. 

,Z In another aspect of this embodiment, the CSBS transmits information to 

^0 reprogram the DED to communicate with another RTP. 

In another aspect of this embodiment, the RTP communicates with a content 
ik matching server. The content matching server stores content match information, 

:^ 20 communicates with the DED, and transmits the content match information to the DED. 

In another aspect of this embodiment, the DED suspends transmission of the at 
least one data packet through the information network until a response to the prompt is 
received. 

In another embodiment, an apparatus in accordance with the present invention 
25 includes a Central Storage and Backup System (CSBS) that commxmicates with a 
plurality of Regional Transaction Processors (RTPs) and provide backup storage for the 
RTPs. The RTPs communicate with a Data Enabling Device (DED) and at least one 
workstation. The DED detects content match information in at least one data packet. The 
RTP comprises instructions to generate information to include in a prompt to be presented 
30 at the workstation. The prompt is based on information in the data packet. 
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5 In one aspect of this embodiment, the CSBS monitors the operation of the RTFs. 

In another aspect of this embodiment, the CSBS stores transaction information for 
the RTFs. 

In another aspect of this embodiment, the CSBS maintains the content 
match information. 

10 In another embodiment, a computer program product in accordance with the 

present invention includes instructions to enable communication between a workstation, a 
Data Enabling Device (DED), and a Regional Transaction Processor (RTP). The DED 
detects content match information in at least one data packet and prevents further 
transmission of one or more data packets based on the information in the at least one data 
□ 15 packet. The RTP generates information to include in a prompt to be presented at the 
Zi workstation. The prompt is based on information in the at least one data packet. 

?!1 The foregoing is a summary and thus contains, by necessity, simplifications, 

f generalizations and omissions of detail; consequently, those skilled in the art will 

C3 appreciate that the summary is illustrative only and is not intended to be in any way 

20 Umiting. As will also be apparent to one of skill in the art, the operations disclosed herein 
Q may be implemented in a number of ways, and such changes and modifications may be 

made without departing from this invention and its broader aspects. Other aspects, 
inventive features, and advantages of the present invention, as defined solely by the 
claims, will become apparent in the non-limiting detailed description set forth below. 

25 BRIEF DESCRIPTION OF THE DRAWINGS 

The present invention may be better understood, and its numerous objects, 
features and advantages made apparent to those skilled in the art by referencing the 
accompanying drawings. The use of the same reference number throughout the several 
figures designates a like or similar element. 

30 Figure la shows an embodiment of a network that includes a DED at a Network 

Access Point (NAP) and a Regional Transaction Processor (RTP) in accordance with the 
present invention. 
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Figure lb shows an embodiment of a Regional Transaction Processor (RTP) of 
Fig. la which interacts with the DED. 

Figure Ic shows an embodiment of a Content Matching Server (CMS) of Fig. la 
which can reprogram the DED as required. 

Figure Id shows an embodiment of a Central Storage and Backup 
Systems (CSBS) for storing back-up information for the RTF's shown in Fig. la. 

Figure le shows an embodiment of a process for handling purchasing transactions 
using the network in Fig. la. 

Figure If shows an embodiment of a process using the network in Fig. la to 
calculate sales tax on a transaction conducted over the network in Fig. la. 

Figure Ig is a block diagram of an example of a workstation that is suitable for 
use in the network of Fig. la. 

Figure 2a is a diagram of the Intemational Standards Organization (ISO) Open 
Systems Literconnect (OSI) model showing layered data encapsulation. 

Figure 2b is a diagram of the layered data encapsulation known in the prior art. 

Figure 3a is a diagram of a packetized elementary stream packet for 
an MPEG file. 

Figure 3b is a diagram of a transport stream for an MPEG file. 

Figure 4a is a flow diagram of one embodiment of a data enabhng procedure that 
can be utilized in the network shown in Fig. la. 

Figure 4b is a sample screen prompt presented to a private workstation when 
attempting to download copyright protected files with a transaction option in accordance 
with the process in Fig. 4a. 

Figure 4c is a sample screen prompt presented to a public workstation when 
attempting to download copyright protected files with a transaction option in accordance 
with the process in Fig. 4a. 
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5 Figure 4d is a sample screen prompt presented to a workstation when attempting 

to download copyright protected files with no transaction option in accordance with the 
process in Fig. 4a. 

Figure 4e is a sample screen prompt presented to a workstation when a virus is 
detected at the NAP and prevented from being downloaded to the workstation in 
1 0 accordance with the process in Fig. 4a. 

Figure 4f is a sample screen prompt presented to a workstation when a virus is 
detected in data sent from the user at the NAP in accordance with the process in Fig. 4a. 

Figure 4g is a sample screen prompt presented to a workstation when confidential 
data is detected at the NAP in accordance with the process in Fig. 4a. 

13 15 Figure 4h is a sample screen prompt presented to a System Administrators 

rn workstation when one of the workstations on the network is attempting to transmit 

2t confidential data over the network in accordance with the process in Fig. 4a. 

yj Figure 4i is a sample screen prompt presented to a workstation when a purchase is 

made over the network in accordance with the process in Fig. 4a. 

M 20 Figure 5a is a block diagram of a network of NAPs that includes DEDs in 

ri accordance with the present invention. 

Figure 5b is a block diagram showing lines of communication between a series of 
DEDs along a path for transmitting data packets over the network shown in Fig. la. 

Figure 5c is a block diagram of a series of DEDs along a path for transmitting two 
25 or more data packets associated with the same content over the network shown in Fig. la. 

Figure 5d is a block diagram of multiplexed data packets transmitted along two 
unique paths in the network shown in Fig. la. 

Figure 5e is a diagram of a network with multiple DEDs for monitoring data 
packets in accordance with the present invention. 

30 Figure 6a is a diagram of one type of device that can be utilized as a DED that can 

be utiUzed in the network of Fig. la. 
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5 Figure 6b is a diagram showing a switching circuit that can forward traffic to 

the DED shown in Fig. 6a. 

Figure 7 is a block diagram of network access points and workstations that 
communicate with the Regional Transaction Processor (RTP) on a regional and local 
level in accordance with the present invention. 

10 Figure 8a is a flow chart of one embodiment of a communication process between 

the DED, the RTP, and the workstation that can be utilized in the network shown in Fig. 
la. 

Figure 8b is a flow chart of one embodiment of an initialization process to 
establish communication between the DED, the RTP, and the workstation that can be 
H= 1 5 utilized in the network shown in Fig. 1 a. 

c3 

l7i Figure 8c is a flow chart of one embodiment of a process for preventing 

^ J;! confidential content from being transmitted onto a network from a workstation that can be 

utilized in the network shown in Fig. la. 

r . Figure 8d is a flow chart of one embodiment of a process for preventing content 

p 20 infected with a virus from being transmitted over a network to a workstation that can be 
utihzed in the network shown in Fig. la. 

"""^ Figure 8e is a flow chart of one embodiment of a process for preventing content 

infected with a virus from being transmitted onto a network fi-om a workstation that can 
be utilized in the network shown in Fig, la. 

25 Figure 9 is a block diagram of an embodiment of a centralized data storage facility 

for the RTFs that can also reallocate the DEDs to a different RTFs in the network shown 
in Fig. la. 

Figure 10 is a block diagram of one embodiment of a Content Matching 
Server (CMS) for providing the DEDs shown in the network of Fig. la with content 
30 matching information. 

Figure 1 1 is a block diagram of one embodiment of a point of purchase system 
within the NAP shown in the network of Fig. la. 
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5 DETAILED DESCRIPTION 

Fig la shows an embodiment of a network 100 that includes a Data Enabling 
Device (DED) 102 at a Network Access Point (NAP) 104. The DED 102 can be 
positioned between a switch 106 and routers/switches 108. Switch 106 allows 
workstations 114 connected to networks 110, 112, 124 to commxmicate with NAP 104, 
10 and routers/switches 108 allow NAP 104 to communicate with other NAPs (not shown). 

Content match information is used to identify content in a data packet and is 
stored in a Content Matching Server (CMS) 1000. The CMS 1000 provides copies of the 
content matching information to DEDs 102 to perform content matches on data packets 
that are transmitted to the DEDs 102, The content match information can comprise any 
15 data string that uniquely identifies the content. For example, the content match 
o information can be a string of digital data from the digital recording of a song. 

\: The term "content match" as used herein refers to the process of comparing the 

content match information in the DED 102 to content match information in a data packet. 
"^■^ For example, the DED 102 detects a content match when a string of digital data in a 

L--'- 20 packet matches an identical string of data that was provided as content match information 
fi in the DED 102. 

?'f Control information is used to determine whether a data packet in which content 

match information was found can be transmitted to the workstation 114. The control 
information can include information such as an identifier for a virus, whether the content 
25 is subject to copyright protection or security (confidentiality) controls, purchase price, 
and/or the number of copies a user can make of the content. The control information is 
typically provided by the entity that wants to monitor and/or control dissemination of 
content, such a music recordings or books, over the network 100. 

The content match information can be updated as required in the CMS 1000, 
30 which in turn updates the DED 102 with the new content match information. DED 102 
non-intrusively searches data packets for the content match information. The term "non- 
intrusive" denotes searching the data packets for the content match information without 
delaying delivery of the packets. When the DED 102 detects the content match 
information in a packet, the DED 102 invokes a Regional Transactional 
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5 Processor (RTP) 128 to perform one or more transactions based on the 
control information. 

Users access the information network 100 through a NAP, such as NAP 104. 
DED 102 can monitor all digital content transmitted between users connected to NAP 104 
and other NAPs (not shown). Conmiunication protocols are used to transport information 
10 from NAP to another. The protocols form a stack of layers, each layer communicating 
with the one above it or below it by passing information in a suitable form to the 
next layer. 

Figure lb shows an embodiment of the Regional Transaction Processor (RTP) 128 
that includes various hardware and software components that allow it to communicate 
15 with the DED 102, facilitate and process transactions, and store the related information 
securely over the Intemet. The router 152 routes data between web server 148 and 
H DED 102 via firewall 146. enterprise switch 144 then routes data to storage system 142, 

^=4 database (DB) server 130, accounting server 140, or remote access server 150, depending 

Tfi on the instructions received in the data. 

- 20 Fig. Ic shows an embodiment of the CMS 1000 of Fig. la that can update the 

Q DEDs 102 as required with content match information. The remote access server 170 can 

receive content match information directly from content owners via communication lines 
O connected to the content owners' servers. The DB server 168 and storage system 166 

store the content match information. Enterprise switch 164 transmits the content match 
25 information to the DED 102 through firewall 162 and router 160. 

Fig. Id shows an embodiment of the Central Storage and Backup System 
(CSBS) 900 of Fig. la that backs up and stores data from the RTFs 128. CSBS 900 
receives data from the RTFs 128 through router 172, firewall 174, and enterprise 
switch 176 to back-up onto storage systems 178 and 180. DB server 182 date stamps and 
30 logs all information received. 

Fig. le shows an embodiment of the RTP 128 of Fig. la that processes 
transactions based on messages from the workstation 114 and the DED 102. The 
accounting server 140 receives mid processes transactions using data in the DB 
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5 server 130, the remote access server 150, and external billing systems 156 to facilitate 
transactions at the workstation 114. 

Fig. If shows an embodiment of the RTP 128 of Fig. la having access to a tax 
lookup table 158 stored on the DB server 130 or the storage system 142. The tax 
table 158 can be used to determine the amount of sales tax rates to add to the price of 
10 delivering content through the DED 102 or other retail transactions made by a user at the 
workstation 114. An identifier for the workstation 114 and an identifier for the 
corresponding DED 102 can be used to determine which tax tables or tax rate formula to 
use to determine the amount of state and/or local sales tax to charge for a transaction. 

The various embodiments of components shown in Figs. Ib-lf can be configured 
15 in many different ways to support transactions at workstation 114. 

The DED 102 and the RTP 128 also can use pubUc/private key 
encryption/decryption technology to decrypt encrypted data packets for content matching, 
and then re-encrypt the data packet and forward it to the workstation 114. Alternatively, 
content match information can be provided to identify the content of a data packet in 
20 encrypted format, thereby eliminating the need to decrypt the data packet. 

Fig. Ig is a block diagram of an example of a computer system suitable for 
implementing the workstation 114, which includes a bus 1122 to interconnect subsystems 
of workstation 114 such as a central processor 1124, a system memory 1126 (typically 
RAM, but which may also include ROM, flash RAM, or the hke), an input/output 

25 controller 1128, an external audio device such as a speaker system 1130 via an audio 
output interface 1132, an external device such as a display screen 1134 via display 
adapter 1136, serial ports 1138 and 1140, a keyboard 1142 (interfaced with a keyboard 
controller 1143), a storage interface 1144, a floppy disk drive 1146 operative to receive a 
floppy disk 1 148, and an optical disc drive 1 150 operative to receive an optical disc 1 152. 

30 Also included are a mouse 1 156 (or other point-and-chck device, coupled to bus 1 122 via 
serial port 1138), a modem 1 157 (coupled to bus 1 122 via serial port 1 138) and a network 
interface 1 158 (coupled directly to bus 1 122). 

Bus 1 122 allows data communication between central processor 1 124 and system 
memory 1 126, which may include both Read Only Memory (ROM) or flash memory 
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5 (neither shown), and Random Access Memory (RAM) (not shown), as previously noted. 
The RAM is generally the main memory into which the operating system and application 
programs are loaded and typically affords at least 16 megabytes of memory space. The 
ROM or flash memory may contain, among other code, the Basic Input-Output System 
(BIOS) which controls basic hardware operation such as the interaction with peripheral 

10 components. Applications resident with workstation 114 are generally stored on and 
accessed via a computer readable medium, such as a hard disk drive (e.g., fixed 
disk 1154), an optical drive (e.g., CD-ROM drive 1150), floppy disk unit 1146 or other 
storage medium. Additionally, applications may be in the form of electronic signals 
modulated in accordance with the application and data conraiunication technology when 

15 accessed via network modem 1 157 or network interface 1158. 

Storage interface 1144, as with the other storage interfaces of workstation 114, 

Q may connect to a standard computer readable medium for storage and/or retrieval of 

id 

ri information, such as a fixed disk drive 1154. Fixed disk drive 1154 may be a part of 

-jj workstation 1 14 or may be separate and accessed through other interface systems. Many 

y 20 other devices can be connected such as the mouse 1 156 connected to bus 1 122 via serial 
^5 port 1138, a modem 1157 connected to bus 1122 via serial port 1140 and the network 

Q interface 1158 connected directly to bus 1122. Modem 1157 may provide a direct 

-^0 connection to a remote server via a telephone link or to the Internet via an Internet 

J'f Service Provider (ISP). Network interface 1158 may provide a direct connection to a 

25 remote server via a direct network link to the Internet via a POP (point of presence). 
Network interface 1158 may provide such connection using various communication links, 
such as a dial-up wired connection with a modem, a direct link such as a Tl, ISDN, or 
cable line, a wireless connection through a cellular or satellite network, or a local data 
transport system such as Ethemet or token ring over a local area network. 

30 Many other devices or subsystems (not shown) may be connected in a similar 

manner (e.g., bar code readers, document scanners, digital cameras and so on). 
Conversely, it is not necessary for all of the devices shown in Fig. Ig to be present to 
practice the present invention. The devices and subsystems may be interconnected in 
different ways from that shown in Fig. Ig. The operation of a computer system such as 

35 that shown in Fig. Ig is readily known in the art and is not discussed in detail in this 
apphcation. Code to implement the present invention may be stored in computer- 
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5 readable storage media such as one or more of system memory 1126, fixed disk 1154, 
CD-ROM 11 52, or floppy disk 1 148. Additionally, workstation 1 14 may be any kind of 
computing device, and so includes personal data assistants (PDAs), network appliance, 
desktop, laptop, X-window terminal or other such computing device's. The operating 
system provided on workstation 114 may be MS-DOS®, MS-WINDOWS®, OS/2®, 
10 UNIX®, Linux® or other known operating system. Workstation 114 also supports a 
number of Internet access tools, including, for example, an HTTP-compliant web browser 
having a JavaScript interpreter, such as Netscape Navigator®, Microsoft Explorer® and 
the like. 

The International Standardization Organization (ISO) has created a protocol layer 
15 model that distinguishes the typical tasks needed in communication. This model is called 
M= the Open Systems Interconnection (OSI) reference model 200 and is shown in Fig. 2a, 

S This OSI protocol is used as an example protocol and is a representation of the various 

iy protocols currently in use. Fig. 2b is a subset of the OSI protocol in Fig. 2a known as the 

m Internet Protocol (IP). Each protocol layer has a standard defined mput and outpvit, and 

ri 20 provides clearly defined fimctions that can in[iprove coimectivity between equipment 
s provided by different manufacturing companies. 

n Referring to Fig. 2a, a user's content 202 is transformed through the layers into a 

'f? bit stream 204 as it is transmitted through the network 100 (Fig. la). Each layer provides 

services to the layer above it, while shielding the upper level fi-om what happens below. 
25 Each layer can add a header and a trailer to the packet as the packet moves through the 
layers. The headers contain information that specifically addresses layer-to-layer 
communication. For example, the transport header (TH) includes information that only 
the transport layer uses. All other layers below the transport layer pass the transport 
header as part of the packet. 

30 The application layer 206 (also referred to as layer 7) deals with printing, file 

transfer, remote terminal services, and directory browsing. Some user applications exist 
directly at the application layer 206, such as the known Telnet and FTP for file transfer 
protocol. Other user applications have application layer fimctions built into them. For 
example, a word processing program that can print to a network printer has application 

35 layer fimctions built into it. 
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5 The primary job of the presentation layer 208 (also referred to as layer 6) is that of 

translator. It takes care of translating ACSII into EBCIDIC, and vice versa, compression, 
decompression, encryption, and decryption. Essentially, the presentation layer 208 
transforms data into the form that the application layer 206 can accept. 

Session layer 210 regulates the flow of information between applications. It 
10 synchronizes commxmication, and takes care of security and handling errors outside the 
scope of network communications, such as a server with a full disk drive, or a disk that 
needs to be inserted. 

The objective of transport layer 212 (also referred to as layer 4) is to provide 
reliable data transmission for the layers above it. The transport layer 212 uses sequence 

15 numbers and flow control to keep information moving at the controlled rate, and to assure 
that the recipient knows how to reassemble an incoming stream of data blocks in the 
correct order. The transport layer 212 also performs multiplexing; combining data to 
conserve bandwidth, or splitting a file into smaller data packets that can travel over 
several network pathways. The transport layer 212 can send a signal back to the upper 

20 layers when a transmission cannot get through. 

Network layer 214 (also referred to as layer 3) deals with moving packets of 
information across a network. Large networks are made up of smaller sub-networks 
called segments. Within a segment two systems can communicate with each other just by 
referencing their layer two hardware addresses. To cross from one segment to another, 

25 systems need to know the network layer address of the destination system. Devices that 
operate on layer three of the network forward packets from one segment to the next based 
on the destination network address of the packet. They choose how to forward the packet 
by either dynamically determining the best route, or by looking up a route from a static 
table. Through this method a packet is routed one node at a time from its source, across 

30 the network, to its destination. 

Data link layer 216 (also referred to as layer two) performs several tasks. It 
compiles the stream of ones and zeros coming from the physical layer 218 into bytes, and 
then into frames. The data link layer 216 can add its own header to the information it 
passes down to the physical layer 218. Information in the header usually includes the 
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5 destination and source addresses of the frame. The data hnk layer 216 also detects and 
rejects corrupted frames and performs flow control. 

Physical layer 218 (also referred to as layer one) transforms data to and from a 
signal on the network media and defines functionality of the network hardware including 
connector types, on/off signal voltages and durations to define a 1 or a 0, and whether the 
10 media is copper wire, optical fibers, or open air. 

Content 202 can be in one of a variety of formats, such as documents created with 
a word processing program, image data, audio data, or a combination of audio and video 
data, to name a few. File formats can include their own control information regarding the 
data in the file. 

J:;J 15 As an example of a file format. Motion Picture Experts Group (MPEG-2) files can 

W contain MPEG-2 compressed video, compressed audio, control data, and/or user data, 

[fl The most basic file component is known as an Elementary Stream (ES) 302, 304, 306, 

J=H 308. A program, such as a television program or a Digital Versatile Disk (DVD) track, 

■= contains a combination of elementary streams (typically one for video, one or more for 

PJ 20 audio, control data, subtitles, etc). Each ES 302, 304, 306, 308 output by an MPEG 

audio, video, and some data encoders contain a single type of signal that is usually 
O compressed. There are various forms of ES 302, 304, 306, 308, including: 

^ Digital Control Data, 

Digital Audio (sampled and compressed), 
25 Digital Video (sampled and compressed), and 

Digital Data (synchronous, or asynchronous). 

For video and audio, the data is organized into access units, each representing a 

fundamental unit of encoding. For example, in video, an access unit will usually be a 

complete encoded video frame. 

30 Each ES 302, 304, 306, 308 is input to an MPEG-2 processor (e.g. a video 

compressor or data formatter) which accumulates the data into a Packetized Elementary 
Stream (PES) packet 310, an example of which is shown in Fig. 3a. The PES packet 310 
may be a fixed or variable sized block, with up to 65536 bytes per block and includes a 6 
byte protocol header 312. The information in the PES header 312 is, in general, 
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5 independent of the transmission method used. A PES packet 310 usually is organized to 
contain an integral number of ES 302, 304, 306, 308, collectively referred to as a 
payload 314. 

The PES header 312 includes a start code, a stream identifier (i.e., audio, video, of 
command/control identifier), and PES Indicators. The PES Indicators provide additional 

10 information about the stream to assist processing of the PES packet 310 including 
whether scrambling is used, the chosen scrambling method, priority of the current PES 
packet 310, whether the payload 314 starts with a video or audio start code, whether the 
payload 314 is copyright protected, whether the ES 302, 304, 306, 308 is original, and a 
set of optional fields, which if present, are inserted before the start of the PES 

15 payload 314. The optional fields include presentation and decode time stamps, an 
Elementary Stream Clock Reference (ESCR), the rate at which the ES 302, 304, 306, 308 
was encoded, trick mode, copyright information, CycUc Redundancy Check (CRC), and 
PES extension information, which may be used to support MPEG-1 streams. 

Referring to Fig. 3b, a transport stream 320 consists of one or more programs, 
20 Each program is defined as a collection or a multiplex of individual program elements 
that share the same time base. The transport bit stream comprises transport 
packets 322, 324 having 188 bytes each. The transport header 326 contains a Program ID 
(PID) to identify the contents of the packet, along with time stamps. The transport 
payload 328 encapsulates PES packet(s) 310 as well as dedicated transport packets, 
25 known as the Program Specific Information (PSI), which are set aside to identify the 
structure of the stream. 

While Figs. 3a and 3b show the format for MPEG-2 files, files in one of many 
different known formats, and subsets of known formats, can be transported through 
network 100 (Fig. la) using the OSI reference model 200 (Fig. 2a). For example, MPEG 
30 Layer III (also referred to MP3), is a file format for the audio portion of MPEG files. 

The communication protocol header and/or trailer for each layer, as well as the 
content 202 (Fig, 2a), can include content match information and control information. 
The DEDs 102 (Fig. la) search data packets for the content match information to 
determine whether transmission of data packets associated with a particular piece of 
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5 content should be restricted. If transmission of associated data packets is restricted, then 
the control information is used by the RTFs 128 (Fig. la) to determine which 
transaction(s) to process to control transmission of the data packets. While some of the 
header and trailer fields are designated for specific parameters, other fields can be 
allocated to allow the creator of the content 202 to include the control information The 
10 control information can be unique to the creator, user, and/or content 202, and can be 
encrypted or unencrypted. 

In one embodiment, the creator adds the content match information and the 
control information at application layer 206. The content match information is also 
supphed to DED 102 (Fig. la) as described hereinbelow. DED 102 can then search the 
15 transport streams 320 (Fig. 3b), also referred to as data packets, being transmitted through 
U NAP 104 (Fig. la) to determine whether the data packets include the content match 
£3 information, 

m The content provider also can sxipply or indicate transaction instructions to be 

used in the RTF 128 when the DED 102 matches the content match information in a data 

- 20 packet. For example, if the user is required to pay for the content before receiving it, the 

J3 RTF 128 transmits a transaction prompt to the user's workstation 1 14 (Fig. la) informing 

the user of the price to be paid for the content, and allowing the user to accept or decline 

C3 the purchase. As another example, the RTF 128 can transmit a prompt to inform the user 

that content infected with a virus is attempting to be transmitted from or received to the 
25 user's workstation 114, and that transmission or reception of the virus is being halted. As 
another example, the RTF 128 can transmit a prompt to inform the user that content 
subject to security control is attempting to be transmitted from or received to the user's 
workstation 114, and that transmission or reception of the confidential content is being 
halted. As a fiirther example, the RTF 128 can tally statistics regarding transmission of 
30 designated content for purposes such as rating the popularity of the content. 

Referring now to Fig. 4a, a flow diagram of an embodiment of a method for 
processing data packets in the network 100 (Fig. la) in accordance with the present 
invention is shown. Frocess 402 searches each data packet for content match 
information, DED 102 can perform multiple content matches on each data packet, as 
35 indicated by the series of processes 402-406. Each content match searches for content 
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5 unique to the application(s) being performed by various entities such as content providers, 
business organizations, and/or government organizations. The appHcations can handle 
various situations based on the content, such as collecting payment for the authorized use 
of copyrighted content, preventing outgoing transmission of confidential material, 
preventing incoming receipt of material previously designated as unwanted by the 
10 recipient, and preventing the transmission of files containing viruses to the 
workstations 114 (Fig. la). 

Process 402 can include logic to search for particular watermarks or fingerprints 
to identify copyright content based on the content match information from the content 
providers. It also can include logic to imderstand one or more hashing fimctions. 

15 If content is not matched in a data packet, process 402 forwards the data packet to 

its destination. If a content match is found in the data packet, process 404 determines 
whether the subject data packet is simply being monitored for statistical analysis or 
sampling. If so, process 405 updates the database 130 with the specified statistics or 
samples, and the data packet is transmitted to its destination. 

20 When process 404 determines that the data packet is not just being monitored for 

statistical analysis or sampling, process 410 can temporarily store the incoming packets 
associated with the data packet for which a content match was found in buffer 412 while 
process 414 determines whether the RTP 128 should be invoked to process a transaction. 

In one embodiment, process 414 queries database 130 to determine whether a 
25 transaction accoimt for the user exists. A transaction account for a user can be estabhshed 
in many different ways. In one implementation, the transaction account for the user is 
established by the user's network service provider at the NAP 104. The user typically 
must pay a network service provider for access to the network 100 (Fig. la), and therefore 
the same billing account can be used with minimal overhead. Alternatively, the user can 
30 supply electronic payment information, such as a credit or debit card number, a prepaid 
card number, or use an electronic wallet as known in the art, to establish a 
transaction account. 
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5 If the user requesting the content that is being downloaded has estabUshed a 

transaction account, process 416 generates a notice that is presented to the user. Various 
types of prompts and messages can be generated by process 416 and presented to the 
user's workstation 114 (Fig. la) by process 418. The type of message or prompt depends 
on the control information in the data packet. The control information is transmitted to 
1 0 the RTP 1 28 by the DED 1 02. 

For example, process 416 can generate a prompt 450 such as shown in Fig. 4b to 
inform the user that they must agree to pay a fee to download the requested copyrighted 
content. The user can indicate their decision to either accept or decline the charge by 
selecting the "yes" or "no" options on the display. If the purchase was accepted, the user 
15 can provide electronic payment information, such as a credit card number, or check a box 
H^' and provide a password or authorization code to authorize the charge to their established 

p network service provider account. 

Ifi As another example, process 416 can generate a prompt such as shown in Fig. 4c 

at workstations 114 (Fig. la) that only allows the users to supply some form of electronic 
- 20 payment, such as a credit card number. 

Fig 4i shows an example of a prompt that includes notice of a retail transaction 
G from a participating retailer over the network 100 (Fig. la). The prompt includes 

shipping and handling information, and the amount of sales tax on the purchase, which is 
derived from a tax table stored in the RTP 128 (Fig. If). 

25 Process 420 determines whether the user agreed to pay for the content. This can 

be implemented by monitoring the user's response to the notice that was sent in 
process 418. Process 422 processes the transaction if the user agrees to pay for the 
copyrighted material, and process 424 updates the database 130 with relevant information 
regarding the transaction. Process 408 resumes transmission of the data packets from 

30 buffer 41 2 to their destination. 

If process 420 determines that the client has not purchased the content, 
process 426 updates the database 130 with relevant information regarding the aborted 
download, and process 428 discards the data packets associated with the content. 
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5 Referring again to process 414, if a transaction account does not exist, process 430 

generates a message, such as shown in Fig. 4d indicating that the content cannot be 
downloaded to the user's workstation because the content is protected and is not 
authorized for downloads or uploads. 

Figs. 4e and 4f show examples of messages that can be generated by process 430 
10 and presented by process 432 to the user's workstation to inform the user that the content 
is infected with a virus and therefore will not be downloaded or uploaded. The user can 
choose an option to attempt to clean the virus from the file using an anti-virus utihty. 

Fig, 4g shows an example of another message that can be generated by 
process 430 and presented by process 432 to the user's workstation to inform the user that 
15 they are attempting to upload secured information to the Internet and the transmission has 
been halted. 

Fig 4h is an example of a message that can be generated by process 430 and 
forwarded to a system administrator to provide notice of an attempt to transmit content 
subject to security controls from one of the workstations 1 14 on the network 100 (Fig. 1). 

20 Process 434 can be included to update database 130 to record information 

regarding the denial to transmit the content. Entries also can be made in database 130 
that may be used to generate statistical information regarding the download attempts. 
This information in database 130 regarding the content also can be provided to and/or 
accessed by the owner of the content. 

25 Process 436 ceases transmission of the content, and process 428 discards the data 

packets associated with the content. In one implementation, process 428 deallocates the 
memory occupied by the content's data packets in data buffer 412 to make the memory 
available to store other data packets. 

In some implementations, processes 434 and 426 can give the user privacy options 
30 to withhold some or all of the user's information in database 130 from outside access and 
dissemination. 
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5 Referring now to Fig. 5a, a diagram of network 500 is shown that includes 

multiple NAPs 104 and DEDs 102 along the various levels of the network 500. The 
DEDs 102 can reside at multiple locations along routes for transmitting packets through 
the network 500. 

Fig. 5b shows a block diagram of multiple DEDs 102 in a network 510. Since 
10 multiple DEDs 102 can be installed throughout the network 510, data packets are likely to 
encounter more than one DED 102 during transmission through the network 510. The 
DEDs 102 can communicate with each other as described in the following paragraphs in 
order to prevent more than one prompt being presented to the user for the same packet, or 
set of packets associated with the same content. 

h== 15 When the sending DED 102 A matches content in a data packet with content 

O match information, the sending DED 102 A generates and transmits a message that 

J"5 includes information to generate a prompt to the user at the destination workstation 1 14D. 

U1 In some embodiments, the message includes information such as an identifier for the 

M DED 102D closest along the route to workstation 114D, an identifier of the content, a 

f 20 flow identifier that indicates the network route between the sending DED 102 A and the 
u receiving DED 102D, the control information for the content, and an identifier for the 

RTP 128 associated with DED 102D. DED 102B, which is Anther along the route to 
p workstation 1 14D, interprets the message from the sending DED 102A and transmits the 

message to the next downstream DED 102C. The message is transmitted to each 
25 downstream DED along the route until the message reaches the destination DED 102D. 

The destination DED 102D transmits a message to inform the workstation 11 4D of the 

potential transaction, hi response, the workstation 114D transmits the message to the 

RTP 128 along with an identifier of the workstation 1 14D. 

The identifier for the workstation 1 14D is unique to allow the RTP 128 to send the 
30 prompt, such as shown, for example, in Figs. 4b-4I, to the workstation 114D. The 
information presented in the prompt is based on the transaction to be performed. For 
example, the prompt 450 shown in Fig. 4b informs the user at the workstation 114D that 
the content requested is subject to copyright protection and must be paid for before it can 
be downloaded to the user. The prompt 450 includes data entry windows and selectable 
35 options that allow the user to indicate whether they accept or dechne to purchase the 
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5 content at workstation 1 14D, If the user agrees to the price and the terms, the transaction 
is authorized at the RTP 128. The RTP 128 conducts the required transaction and sends a 
Release_Content or Cease_Content transmission message to the DED 104D, depending 
on whether the content was authorized to be downloaded to the destination 
workstation 114D. 

10 To prevent each DED 102D, 102C, 102B from performing a content match on the 

same packet, DED 102D forwards the message to all upstream DEDs 102C, 102B, 102 A. 
If a Release_Content message is received, the DED 102 A places a Release_Content 
identifier in the packet to indicate that the content is approved for transmission and then 
transmits the packet. The downstream DEDs 102B, 102C, and 102D along the route in 

15 the network 510 recognize the Release_Content identifier and transmit the packet without 
Ji; performing another content match, or generating another prompt, for the same packet. 

If the Cease_Content transmission message is received, the originating DED 1 02A 
in will not transmit the packet and clears the packet from its buffer 

- The Release__Content identifier indicating that the content is approved for 

hj 20 transmission can be any combination of data that the DEDs are programmed to recognize 
'Z^ as indicating that the packet can be transmitted with a content match. For example, the 
C3 Release_Content identifier can be a setting of one or more bits in the header of trailer of 

the packet, or in the packet's payload. The identifier can be encrypted or decrypted, or 
implement other security mechanisms known in the art. Notably, the Release Content 
25 identifiers and location in the packets can be updated or modified periodically to 
minimize the likelihood of users successfully transmitting unauthorized content by adding 
similar Release_Content identifiers to the packets. The Release Content identifier can 
also include time/date stamp to indicate that the packet is authorized to be transmitted 
only within a certain time period of the time/date stamp. 

30 Referring now to Figs. 5c and 5d, a series of packets within a TCP stream 

transmitted from sending workstation 1 14 A to destination workstation 11 4D may not take 
the same path through network 520 due to redundant paths and the load sharing 
capabilities of the routers 108 (Fig. la). More than one packet associated with the same 
content can therefore be subject to content matching at different DEDs. To prevent 
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5 multiple content matches for related packets, when the DED 102 A matches the content 
match information, the DED 102 A buffers all of the packets associated with the content, 
and transmits a message along the route to the DED 102D associated with the destination 
workstation 114D. The DED 102D notifies the workstation 114D, the workstation 114D 
transmits the message along the its identifier to the RTP 128, and the RTP 128 conducts 

10 the required transaction. Once the transactions, if any, associated with the message have 
been processed by the RTP 128, the RTP 128 sends the Release_Content or 
Cease_Content message to the DED 102D, depending on whether the content was 
authorized to be downloaded to the destination workstation 114. DED 102D forwards the 
message to all upstream DEDs 102C, 102B, 102 A, 102E. The Release_Content message 

15 includes an identifier for the TCP stream so that the packets authorized for transmission 
can be identified by each DED along the various routes in the network 520 and allowed to 
J™ continue without generating another prompt for the same packets. 

;j Fig. 5d shows an example where there is no DED at NAP 104A for the sending 

^[J workstation 1 14A. The content is therefore matched downstream after the packets have 

ly 20 taken multiple paths. In this example, content can be matched at DED 102C and 
DED 102E. Each of these DEDs 102C and 102D will generate and send a Message 
C3 through the receiving workstation to the RTP 128 for processing. The RTP 128 sends a 

Ig Release_Content or Cease_Content message prompt to the closest DED 102D to the 

H receiving workstation 1 14D. DED 102D forwards the message to all upstream DEDs that 

25 are buffering packets associated with that particular TCP stream. 

Fig. 5e shows an embodiment of a system in which one or more of the 
DEDs 102 A, 102B, 102C, 102D monitor packets for content as the packets are 
transmitted from workstation 1 14A to workstation 1 14D. hi this embodiment, the control 
information in the packets indicates that the packets can be transmitted without generating 

30 a prompt at workstation 1 14D. As the DEDs match content in the packets, they transmit a 
message to notify the corresponding RTP 128 which includes information to identify the 
packet. The RTFs 128 forwards the information to the CSBS 900. This information can 
be collected for a number of purposes including analyzing the number of times a piece of 
content is transmitted over the network, and the general vicinities of the sending and 

35 receiving workstations. 
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5 Fig. 6a shows an example of a device that can be used to implement DED 102 for 

use in the network 100 in accordance with the present invention. Such a device is 
available from the Field Programmable Port Extender (FPX) Project developed in the 
Applied Research Laboratory, Department of Computer Science, Washington University, 
St. Louis, Missouri, and further described in the publication entitled "Field Programmable 
10 Port Extender (FPX) for Distributed Routing and Queuing" by John W. Lockwood, Jon S. 
Tumer, David E. Taylor, ACM International Symposium on Field Programmable Gate 
Arrays (FPGA'2000), Monterey, CA, February 2000, pp. 137-144. 

DED 102 utilizes Field Programmable Gate Arrays (FPGAs) to provide the 
performance advantage of Application-Specific Integrated Circuits (ASICs) to implement 
15 customized pipelines and perform parallel logic functions. FPGAs also can be 
reprogrammed to perform a content matching function. 

As shown in Fig. 6a, DED 102 includes two FPGA devices: one to implement a 
Network Interface Device (NID) 602 and another to implement a reprogrammable 
application device (RAD) 604. DED 102 is connected to network 100 (Fig. la) via 
20 switch 106 and line card 606. By performing all computations in FPGA hardware, cells 
and data packets can be processed at the full line speed of the line card 606. 

The RAD 604 includes modules 608, 610 that implement the module-specific 
functionality. Each module 608, 610 on the RAD 604 connects to a Static Random 
Access Memory (SRAM) 612, 614, respectively, and to a wide synchronous dynamic 
25 RAM (SDRAM) 616, 618, respectively. The SRAM 612, 614 typically is used for 
appUcations that perform table lookup operations, while the SDRAM 616, 618 typically is 
used for applications such as packet queuing that transfers bursts of data and can tolerate 
higher memory latency. 

The RAD 604 communicates with the NID 602 using a suitable 
30 interface 620, 622, such as the known Universal Test And Operation Physical Interface 
(UTOPIA) for Asynchronous Transfer Mode (ATM) transmission. Data packets 
transmitted over the interface 620, 622 are segmented into a sequence of fixed-size cells 
that are formatted as Internet Protocol (IP) over ATM, as known in the art. Each 
interface 620, 622 can include a small amount of buffering and implement flow control. 
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5 A Start of Cell (SOC) signal is asserted at the input of the modules 608, 610 to indicate 
the arrival of data. The Transmit Cell Available (TCA) signal is asserted back toward an 
incoming data source to indicate downstream congestion. 

The NID 602 controls the flow of data packets to and from the modules 608, 610. 
NID 602 also provides mechanisms to dynamically reprogram the modules 608, 610 over 
10 the network 100 (Fig. la). The combination of these features allows these 

modules 608, 610 to be dynamically loaded and unloaded without affecting the switching 
of other traffic flows or the processing of packets by the other modules in the 
network 100. 

As shown in Fig. 6b, the NID 602 includes several components that can be 
15 implemented in FPGA hardware. The components in NID 602 include: a four-port 
switch 630 to transfer data between ports 632, 634, 636, and 638; Virtual Circuit lookup 
tables (VC) on each port 632, 634, 636, 638 to selectively route flows; a Control Cell 
Processor (CCP) 640 to process control cells that are transmitted and received over the 
network 100 (Fig. la); programming interface logic 642 to reprogram the FPGA 
20 hardware on the RAD 604; and synchronous and asynchronous interfaces (not shown) to 
the four network ports 632, 634, 636, 638. 

The CCP 640 can be implemented in hardware to manage the operation of the 
DED 102 and to communicate over the network 100 (Fig. la). On the ingress interface 
from the switch 106, the CCP 640 listens and responds to commands that are sent on a 
25 specific virtual circuit. The NID 602 processes commands that include: (1) modification 
of per-flow routing entries; (2) reading and writing of hardware status registers, (3) 
reading and writing of configuration memory, and (4) commands that cause the logic on 
the RAD 604 to be reprogrammed. After executing each command, the NID 602 returns 
a response in a control cell. 

30 In order to reprogram the RAD 604 over the network 100 (Fig, la), the NID 602 

implements a reliable protocol to fill the contents of the on-board RAM with 
configuration data that is sent over the network 100. As each cell arrives, the NID 602 
uses the data and the sequence number in the cell to write data into the RAD 604 Program 
SRAM 644. Once the last cell has been correctly received, and the NID 602 holds an 



-31- 



M-n742 US 
765930 v7 



5 image of the reconfiguration byte stream that is needed to reprogram the RAD 604. At 
that time, another control cell can be sent to the NID 602 to initiate the reprogramming of 
RAD 604 using the contents of the RAD Program SRAM 644. 

The DED 102 supports partial reprogramming of the RAD 604 by allowing 
configuration streams to contain commands that program only a portion of the logic on 
10 the RAD 604. Rather than issue a command to reinitialize the device, the NED 602 writes 

the frames of reconfiguration data to the RAD's reprogramming port via programming 
interface 642. This feature enables the other module on the RAD 604 to continue 
processing packets during the partial reconfiguration. 

In embodiments, the DED 102 can be implemented using a combination of 
U 15 hardware, software, and/or firmware. A software-based DED can include a routing chip 
and an embedded processor that executes a kernel operating system. Any suitable 
^ combination of processor and operating system may be used. 

Fig. 7 shows examples of system architectures that can be implemented to process 
transactions in accordance with the present inventions. One implementation includes a 
M= 20 local NAP 104A communicating with RTP 128A, workstation 114A, and DED 102A. 

The workstation 114A communicates with the RTP 128 A after receiving a prompt. For 
j2 payment transactions, for example, the RTP 128 A calculates all fees and costs and 

H= transmits a message to the workstation 1 14A that specifies the amoimt of the transaction. 

When DED 102 A communicates with RTP 128 A in a local region, workstation 114A 
25 communicates with the local RTP 128 A after receiving a prompt. Thus, a local 
RTP 128 A can process transactions in the local community. 

The second implementation can include one or more regional RTPs 128B that 
communicate with local and remote workstations 114B and multiple NAPs 104B in a 
region. For example, the second implementation can include one RTP 128B to 
30 communicate with every NAP 104B in a metropolitan area. RTP 128B would be 
considered a local RTP. In an area with less population, one RTP 128B may be able to 
handle the NAPs 104B in an entire portion of a state. In this situation, RTP 128B would 
be considered a regional RTP. 
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5 Fig. 8a shows one implementation of the commimication process between the 

DED 102, the workstation 114, and the RTP 128. After the workstation 114 has sent a 
request for content that is copyright protected, for example, the DED 102 finds a content 
match and/or the control information which identifies the content in one or more of the 
arriving packets as being copyright protected. In this situation, the process includes the 
10 following steps: 

Step 1. DED 102 transmits a message to the workstation 114. The 
message includes information including an identifier for the DED 102 
closest along the route to workstation 114, an identifier of the content, a 
flow identifier, the control information for the content, and an identifier for 
15 the RTP 128 associated with DED 102. 

Hi Step 2. Workstation 114 initiates a transaction notice to the RTP 128 that 

J=7J includes the identifier of the content, the control information for the 

"===1 content, an identifier of the workstation 114, and the identifier of the 

5 DED 102. 

f 20 Step 3. The RTP 128 determines transaction costs, tax rates, and billing 

n account information using in the transaction notice and in the 

database 130. 

H Step 4. The RTP 128 transmits a purchase prompt to the user at the 

workstation 114, such as shown in Fig. 4a or Fig. 4b. 

25 Step 5. The user at the workstation 114 inputs a purchase decision. 

Step 6. The purchase decision is transmitted to the RTP 128. 

Step 7. The RTP 128 processes payment if the user authorized 
the purchase. 

Step 8. The RTP 128 sends a Release_Content notice to the DED 102 if 
30 payment was authorized. If the user declines the purchase, the RTP 128 

sends a Cease_Content notice to DED 102 to discontinue transmission of 
the content and discard the packets associated with the content. 
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5 Fig. 8b shows an example of a process for initializing communication between the 

workstation 1 14, the DED 102, and the RTP 128 including the following steps: 

Step L The user at the workstation 114 invokes a network browser. The 
browser transmits a startup message to the DED 102. The DED 102 
forwards the startup message to the RTP 128. 

10 Step 2. The RTP 128 transmits an acknowledgment of the message to the 

DED 102. 

Step 3. The DED 102 transmits an acknowledgement to the 
workstation 114 when the DED 102 is ready to perform content matches 
on packets. 

Cp 15 Fig. 8c shows an embodiment of a process for preventing content containing 

[y confidential information from being transmitted over a network 100 (Fig. 1) from the 

^ workstation 114 including the following steps: 

W Step 1. The user at workstation 114 attempts to transmit secured content 

over the network. The secured content includes content match information 
20 that identifies the content as being subject to security controls and 

therefore should not be transmitted. 

Step 2. The DED 102 recognizes the content match information indicating 
that the content should not be transmitted over the network 100 (Fig. 1). 
The DED 102 transmits a prompt, such as shown in Fig. 4g, to the 
25 workstation 1 14 to inform the user of the attempt. 

Step 3. The DED 102 transmits a prompt, such as shown in Fig. 4h, to a 
systems administrator workstation 114 to inform the administrator of the 
attempt and provide an identifier of the workstation 114 and/or the user 
logged on to the workstation 114. 

30 Step 4. The DED 102 transmits a message to the RTP 128 that includes 

information, such as the file attempting to be transmitted, the date and time 
of the attempt, and the identifiers for the workstation 112 and/or the user. 
The RTP 128 stores the information on storage system 142 (Fig. lb). 
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5 Fig, 8d shows an embodiment of a process for halting transmission of computer 

viruses from the network 100 (Fig. 1) to the workstation 114. Once a virus has been 
identified, the DEDs 102 can be programmed with content match information that 
identifies files infected the virus. The process includes: 

Step 1. The DED 102 performs a content match and detects the content 
10 match information indicating the file is infected with a virus. 

Step 2. The DED 102 transmits a prompt, such as shown in Fig. 4e, to 
workstation 1 14 to inform the user of the infected file. 

Step 3. The DED 102 updates the RTF 128 with information regarding the 
attempt to transmit the virus. The RTF stores the information on its 
U 15 storage system 142 (Fig. lb), and the information can be used by system 

p- administrators for purposes such as determining the source of the virus. 

Fig, 8e shows an embodiment of a process for halting transmission of (computer) 
viruses from the workstation 114 to the network 100 (Fig. 1). Once again, when a virus 

S - : 

has been identified, the DEDs 102 can be programmed with content match information 
20 that identifies files infected with the virus. The process includes: 

Step L The DED 102 performs a content match and detects the content 
J^^;^ match information indicating the file is infected with a virus. 

Step 2. The DED 102 transmits a prompt, such as shown in Fig. 4f, to 
workstation 1 14 to inform the user of the infected file. 

25 Step 3. The DED 102 updates the RTF 128 v^th information regarding the 

attempt to transmit the virus. The RTF 128 stores the information on its 
storage system 142 (Fig. lb), and the information can be used by system 
administrators for purposes such as disinfecting the files on all of the local 
workstations and storage systems. 

30 Application programs to support the processes described for Figs. 8a-8e on the 

workstations 114 can be provided to the workstations 114 via downloads from selected 
sites on the network 100 (Fig. 1), or distributed by the NAPs 104. The browser program 
on the workstation 114 can execute the application programs through an application 
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5 program interface, as known in the art. The appUcation programs also can be 
incorporated in later versions of the browser. The appUcation programs include functions 
for receiving messages containing the prompts from the RTFs and DEDs, presenting the 
prompts to the user at the workstation 114, and initiaUzing conamunication between the 
RTFs 128 and the DEDs 102. 

10 Fig. 9 shows a Central Storage and Backup Systems (CSBS) 900 communicating 

with RTFs 128, All transactional information, monitoring information, and RTF 
operational information is forwarded to the CSBS 900 to backup all information and 
monitor the operability of every RTF 128. If an RTF 128 becomes inoperable, the 
CSBS 900 can transmit information to re-route all DEDs 102 associated with the 

15 inoperable RTF 128 to another RTF 128. 

fj Fig. 10 shows a Content Matching Server (CMS) 1000 that can transmit updated 

content match information to all DEDs 102, at regular intervals or as required. This 
H includes new content match information as well as removing or modifying obsolete 

2 content match information. One or more CMSs 1000 may be co-located with the 

^'=^20 CSBS 900 (Fig. la) or located in regional ofSces and connected to 
network 100 (Fig. la). 

Fig. 1 1 shows a representation of a Foint of Furchase (FOF) 1 100 that allows local 
Q and state governments to collect sales tax on sales transactions conducted via the 

network 100. The transactions are processed at the RTF 128 and a prompt summarizing 

25 the cost of the goods or services from the vendor, and the sales tax added, is presented to 
the user at workstation 114. The RTF 128 uses look-up tables 158, such as shown in Fig. 
If and/or a formula to calculate the appropriate tax rates for the transactions. The 
RTF 128 can transmit a payment prompt, such as shown in Fig. 4i, showing the total cost 
of the transaction to the workstation 114. The RTF 128 can bill the appropriate billing 

30 system once the user approves the purchase at the workstation 114. The amount of sales 
tax to charge depends on the state and/or local government in which the workstation 114 
is located. Thus an identifier that provides the location of the workstation 114 can be 
used to determine the amount of sales tax to add to a sales transaction. 

A system and method in accordance with the present invention establishes a new 
35 data enabling point at the NAFs 104 (Fig. la) that will non-intrusively facilitate the 
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5 management of data packets transmitted on the network 100. The utility and advantages 
of such a system and method include: 

1. Facilitating the protection of any digital content that is copyright- 
protected. The DED 102 can be implemented at local NAPs 104, or at the NAP 104 of 
the content provider, to prompt the user for payment of the content. Transmission of 

10 copyright-protected content ceases at the NAP 104 unless the user agrees to pay for 
the content. 

2. Providing facilities for collecting and tabulating information regarding 
designated digital content downloaded or streamed in real time for ratings services and 
statistical analysis. 

15 3. EstabUshing a new virus protection point for all users connected to the 

n NAP 104. This protection point can be updated universally to prevent viruses from 

moving off the network backbone and through the NAPs 1 04. 

^ 4. Providing facilities to prevent confidential information from being 

J" transmitted past the NAP 104 and onto the network 100. 

O 20 5, Moving the Point of Purchase (POP) to a NAP 104 on the local level. 

f5 6. Providing the capability to add taxes and tariffs on transactions subject to 

taxation as the transactions are processed by the RTP 128. 

7. Facilitating the ability of users to purchase digital content from any 
workstation 114 on the network 100. 

25 Including the DED 102 at the NAP 104 establishes processes and facilities for 

monitoring data to and from all users at a common access control point. This enables a 
series of transactions or actions to be triggered depending on the content match 
information in the data packets. This applies to protecting digital copyright content, sales 
transactions for content, and confidential or sensitive information such as medical, 

30 financial, and industrial information, computer virus protection, and numerous other 
security applications. 
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Further, if the use of a standard encryption scheme is agreed to, the DEDs 102 can 
monitor encrypted packets for compUance with the standard. A network 100 in 
accordance with the present invention can prevent transmission of encrypted files that do 
not conform to the standard encryption scheme over network 100. 

The foregoing detailed description has set forth various embodiments of the 
present invention via the use of schematic diagrams and examples. It will be imderstood 

by those within the art that each schematic diagram component and operations and/or 
components illustrated by the use of examples can be implemented, individually and/or 
collectively, by a wide range of hardware, software, firmware, or any 
combination thereof. 

The above description is intended to be illustrative of the invention and should not 
be taken to be limiting. Other embodiments within the scope of the present invention are 
possible. For example, a system and method in accordance with the present invention can 
utilize a network transport model other than the OSI model (Fig. 2b). Further, the Data- 
Enabling Device (DED) could take the form of software running over existing hardware 
switching systems located at the NAP. Variations and modifications of the embodiments 
disclosed herein can be made based on the description set forth herein, without departing 
from the spirit and scope of the invention as set forth in the following claims. 
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